--- /dev/null
+From f375916505c83abc0fc7fe8da360de71546d4380 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 24 May 2019 11:16:22 +0800
+Subject: ath10k: fix fw crash by moving chip reset after napi disabled
+
+From: Miaoqing Pan <miaoqing@codeaurora.org>
+
+[ Upstream commit 08d80e4cd27ba19f9bee9e5f788f9a9fc440a22f ]
+
+On SMP platform, when continuously running wifi up/down, the napi
+poll can be scheduled during chip reset, which will call
+ath10k_pci_has_fw_crashed() to check the fw status. But in the reset
+period, the value from FW_INDICATOR_ADDRESS register will return
+0xdeadbeef, which also be treated as fw crash. Fix the issue by
+moving chip reset after napi disabled.
+
+ath10k_pci 0000:01:00.0: firmware crashed! (guid 73b30611-5b1e-4bdd-90b4-64c81eb947b6)
+ath10k_pci 0000:01:00.0: qca9984/qca9994 hw1.0 target 0x01000000 chip_id 0x00000000 sub 168c:cafe
+ath10k_pci 0000:01:00.0: htt-ver 2.2 wmi-op 6 htt-op 4 cal otp max-sta 512 raw 0 hwcrypto 1
+ath10k_pci 0000:01:00.0: failed to get memcpy hi address for firmware address 4: -16
+ath10k_pci 0000:01:00.0: failed to read firmware dump area: -16
+ath10k_pci 0000:01:00.0: Copy Engine register dump:
+ath10k_pci 0000:01:00.0: [00]: 0x0004a000 0 0 0 0
+ath10k_pci 0000:01:00.0: [01]: 0x0004a400 0 0 0 0
+ath10k_pci 0000:01:00.0: [02]: 0x0004a800 0 0 0 0
+ath10k_pci 0000:01:00.0: [03]: 0x0004ac00 0 0 0 0
+ath10k_pci 0000:01:00.0: [04]: 0x0004b000 0 0 0 0
+ath10k_pci 0000:01:00.0: [05]: 0x0004b400 0 0 0 0
+ath10k_pci 0000:01:00.0: [06]: 0x0004b800 0 0 0 0
+ath10k_pci 0000:01:00.0: [07]: 0x0004bc00 1 0 1 0
+ath10k_pci 0000:01:00.0: [08]: 0x0004c000 0 0 0 0
+ath10k_pci 0000:01:00.0: [09]: 0x0004c400 0 0 0 0
+ath10k_pci 0000:01:00.0: [10]: 0x0004c800 0 0 0 0
+ath10k_pci 0000:01:00.0: [11]: 0x0004cc00 0 0 0 0
+
+Tested HW: QCA9984,QCA9887,WCN3990
+
+Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wireless/ath/ath10k/pci.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
+index 0298ddc1ff060..f9e409caca688 100644
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -1771,6 +1771,11 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)
+
+ ath10k_dbg(ar, ATH10K_DBG_BOOT, "boot hif stop\n");
+
++ ath10k_pci_irq_disable(ar);
++ ath10k_pci_irq_sync(ar);
++ napi_synchronize(&ar->napi);
++ napi_disable(&ar->napi);
++
+ /* Most likely the device has HTT Rx ring configured. The only way to
+ * prevent the device from accessing (and possible corrupting) host
+ * memory is to reset the chip now.
+@@ -1784,10 +1789,6 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)
+ */
+ ath10k_pci_safe_chip_reset(ar);
+
+- ath10k_pci_irq_disable(ar);
+- ath10k_pci_irq_sync(ar);
+- napi_synchronize(&ar->napi);
+- napi_disable(&ar->napi);
+ ath10k_pci_flush(ar);
+
+ spin_lock_irqsave(&ar_pci->ps_lock, flags);
+--
+2.20.1
+
--- /dev/null
+From b6f32d8e64ae3b1e0fa02a79855522319eef0540 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 20 Dec 2018 17:23:44 +0100
+Subject: drbd: Change drbd_request_detach_interruptible's return type to int
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 5816a0932b4fd74257b8cc5785bc8067186a8723 ]
+
+Clang warns when an implicit conversion is done between enumerated
+types:
+
+drivers/block/drbd/drbd_state.c:708:8: warning: implicit conversion from
+enumeration type 'enum drbd_ret_code' to different enumeration type
+'enum drbd_state_rv' [-Wenum-conversion]
+ rv = ERR_INTR;
+ ~ ^~~~~~~~
+
+drbd_request_detach_interruptible's only call site is in the return
+statement of adm_detach, which returns an int. Change the return type of
+drbd_request_detach_interruptible to match, silencing Clang's warning.
+
+Reported-by: Nick Desaulniers <ndesaulniers@google.com>
+Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/drbd/drbd_state.c | 6 ++----
+ drivers/block/drbd/drbd_state.h | 3 +--
+ 2 files changed, 3 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c
+index 0813c654c8938..b452359b6aae8 100644
+--- a/drivers/block/drbd/drbd_state.c
++++ b/drivers/block/drbd/drbd_state.c
+@@ -688,11 +688,9 @@ request_detach(struct drbd_device *device)
+ CS_VERBOSE | CS_ORDERED | CS_INHIBIT_MD_IO);
+ }
+
+-enum drbd_state_rv
+-drbd_request_detach_interruptible(struct drbd_device *device)
++int drbd_request_detach_interruptible(struct drbd_device *device)
+ {
+- enum drbd_state_rv rv;
+- int ret;
++ int ret, rv;
+
+ drbd_suspend_io(device); /* so no-one is stuck in drbd_al_begin_io */
+ wait_event_interruptible(device->state_wait,
+diff --git a/drivers/block/drbd/drbd_state.h b/drivers/block/drbd/drbd_state.h
+index b2a390ba73a05..f87371e55e682 100644
+--- a/drivers/block/drbd/drbd_state.h
++++ b/drivers/block/drbd/drbd_state.h
+@@ -162,8 +162,7 @@ static inline int drbd_request_state(struct drbd_device *device,
+ }
+
+ /* for use in adm_detach() (drbd_adm_detach(), drbd_adm_down()) */
+-enum drbd_state_rv
+-drbd_request_detach_interruptible(struct drbd_device *device);
++int drbd_request_detach_interruptible(struct drbd_device *device);
+
+ enum drbd_role conn_highest_role(struct drbd_connection *connection);
+ enum drbd_role conn_highest_peer(struct drbd_connection *connection);
+--
+2.20.1
+
--- /dev/null
+From d83792c521378205131c6205cdf0de54b77aaac1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Nov 2018 20:48:19 +0800
+Subject: e100: Fix passing zero to 'PTR_ERR' warning in e100_load_ucode_wait
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit cd0d465bb697a9c7bf66a9fe940f7981232f1676 ]
+
+Fix a static code checker warning:
+drivers/net/ethernet/intel/e100.c:1349
+ e100_load_ucode_wait() warn: passing zero to 'PTR_ERR'
+
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/e100.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
+index 4d10270ddf8fb..90974462743b5 100644
+--- a/drivers/net/ethernet/intel/e100.c
++++ b/drivers/net/ethernet/intel/e100.c
+@@ -1370,8 +1370,8 @@ static inline int e100_load_ucode_wait(struct nic *nic)
+
+ fw = e100_request_firmware(nic);
+ /* If it's NULL, then no ucode is required */
+- if (!fw || IS_ERR(fw))
+- return PTR_ERR(fw);
++ if (IS_ERR_OR_NULL(fw))
++ return PTR_ERR_OR_ZERO(fw);
+
+ if ((err = e100_exec_cb(nic, (void *)fw, e100_setup_ucode)))
+ netif_err(nic, probe, nic->netdev,
+--
+2.20.1
+
--- /dev/null
+From 9f9e4ba2829385bdb075f3b62cd69682a31757d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 28 Oct 2019 17:33:49 +0100
+Subject: iio: adis16480: Add debugfs_reg_access entry
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nuno Sá <nuno.sa@analog.com>
+
+[ Upstream commit 4c35b7a51e2f291471f7221d112c6a45c63e83bc ]
+
+The driver is defining debugfs entries by calling
+`adis16480_debugfs_init()`. However, those entries are attached to the
+iio_dev debugfs entry which won't exist if no debugfs_reg_access
+callback is provided.
+
+Fixes: 2f3abe6cbb6c ("iio:imu: Add support for the ADIS16480 and similar IMUs")
+Signed-off-by: Nuno Sá <nuno.sa@analog.com>
+Cc: <Stable@vger.kernel.org>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/imu/adis16480.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c
+index 6f975538996cd..c950aa10d0ae0 100644
+--- a/drivers/iio/imu/adis16480.c
++++ b/drivers/iio/imu/adis16480.c
+@@ -724,6 +724,7 @@ static const struct iio_info adis16480_info = {
+ .write_raw = &adis16480_write_raw,
+ .update_scan_mode = adis_update_scan_mode,
+ .driver_module = THIS_MODULE,
++ .debugfs_reg_access = adis_debugfs_reg_access,
+ };
+
+ static int adis16480_stop_device(struct iio_dev *indio_dev)
+--
+2.20.1
+
--- /dev/null
+From 9cdb5a6bd5f24ada59779782b56a8fe97eed07a1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 17 May 2019 13:20:11 -0400
+Subject: media: vimc: fix component match compare
+
+From: Helen Koike <helen.koike@collabora.com>
+
+[ Upstream commit ee1c71a8e1456ab53fe667281d855849edf26a4d ]
+
+If the system has other devices being registered in the component
+framework, the compare function will be called with a device that
+doesn't belong to vimc.
+This device is not necessarily a platform_device, nor have a
+platform_data (which causes a NULL pointer dereference error) and if it
+does have a pdata, it is not necessarily type of struct vimc_platform_data.
+So casting to any of these types is wrong.
+
+Instead of expecting a given pdev with a given pdata, just expect for
+the device it self. vimc-core is the one who creates them, we know in
+advance exactly which object to expect in the match.
+
+Fixes: 4a29b7090749 ("[media] vimc: Subdevices as modules")
+
+Signed-off-by: Helen Koike <helen.koike@collabora.com>
+Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
+Tested-by: Boris Brezillon <boris.brezillon@collabora.com>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/media/platform/vimc/vimc-core.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/media/platform/vimc/vimc-core.c b/drivers/media/platform/vimc/vimc-core.c
+index 57e5d6a020b0e..447a01ff4e23c 100644
+--- a/drivers/media/platform/vimc/vimc-core.c
++++ b/drivers/media/platform/vimc/vimc-core.c
+@@ -243,10 +243,7 @@ static void vimc_comp_unbind(struct device *master)
+
+ static int vimc_comp_compare(struct device *comp, void *data)
+ {
+- const struct platform_device *pdev = to_platform_device(comp);
+- const char *name = data;
+-
+- return !strcmp(pdev->dev.platform_data, name);
++ return comp == data;
+ }
+
+ static struct component_match *vimc_add_subdevs(struct vimc_device *vimc)
+@@ -275,7 +272,7 @@ static struct component_match *vimc_add_subdevs(struct vimc_device *vimc)
+ }
+
+ component_match_add(&vimc->pdev.dev, &match, vimc_comp_compare,
+- (void *)vimc->pipe_cfg->ents[i].name);
++ &vimc->subdevs[i]->dev);
+ }
+
+ return match;
+--
+2.20.1
+
--- /dev/null
+From 09a15372d6bee5ced1756e08cbeb835cfaab07fc Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 11 Jun 2019 10:19:41 +0300
+Subject: mlxsw: spectrum_router: Refresh nexthop neighbour when it becomes
+ dead
+
+From: Ido Schimmel <idosch@mellanox.com>
+
+[ Upstream commit 83d5782681cc12b3d485a83cb34c46b2445f510c ]
+
+The driver tries to periodically refresh neighbours that are used to
+reach nexthops. This is done by periodically calling neigh_event_send().
+
+However, if the neighbour becomes dead, there is nothing we can do to
+return it to a connected state and the above function call is basically
+a NOP.
+
+This results in the nexthop never being written to the device's
+adjacency table and therefore never used to forward packets.
+
+Fix this by dropping our reference from the dead neighbour and
+associating the nexthop with a new neigbhour which we will try to
+refresh.
+
+Fixes: a7ff87acd995 ("mlxsw: spectrum_router: Implement next-hop routing")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Reported-by: Alex Veber <alexve@mellanox.com>
+Tested-by: Alex Veber <alexve@mellanox.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ .../ethernet/mellanox/mlxsw/spectrum_router.c | 73 ++++++++++++++++++-
+ 1 file changed, 70 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+index 5b9a5c3834d9e..05a2006a20b9b 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+@@ -1762,7 +1762,7 @@ static void mlxsw_sp_router_probe_unresolved_nexthops(struct work_struct *work)
+ static void
+ mlxsw_sp_nexthop_neigh_update(struct mlxsw_sp *mlxsw_sp,
+ struct mlxsw_sp_neigh_entry *neigh_entry,
+- bool removing);
++ bool removing, bool dead);
+
+ static enum mlxsw_reg_rauht_op mlxsw_sp_rauht_op(bool adding)
+ {
+@@ -1891,7 +1891,8 @@ static void mlxsw_sp_router_neigh_event_work(struct work_struct *work)
+
+ memcpy(neigh_entry->ha, ha, ETH_ALEN);
+ mlxsw_sp_neigh_entry_update(mlxsw_sp, neigh_entry, entry_connected);
+- mlxsw_sp_nexthop_neigh_update(mlxsw_sp, neigh_entry, !entry_connected);
++ mlxsw_sp_nexthop_neigh_update(mlxsw_sp, neigh_entry, !entry_connected,
++ dead);
+
+ if (!neigh_entry->connected && list_empty(&neigh_entry->nexthop_list))
+ mlxsw_sp_neigh_entry_destroy(mlxsw_sp, neigh_entry);
+@@ -2535,13 +2536,79 @@ static void __mlxsw_sp_nexthop_neigh_update(struct mlxsw_sp_nexthop *nh,
+ nh->update = 1;
+ }
+
++static int
++mlxsw_sp_nexthop_dead_neigh_replace(struct mlxsw_sp *mlxsw_sp,
++ struct mlxsw_sp_neigh_entry *neigh_entry)
++{
++ struct neighbour *n, *old_n = neigh_entry->key.n;
++ struct mlxsw_sp_nexthop *nh;
++ bool entry_connected;
++ u8 nud_state, dead;
++ int err;
++
++ nh = list_first_entry(&neigh_entry->nexthop_list,
++ struct mlxsw_sp_nexthop, neigh_list_node);
++
++ n = neigh_lookup(nh->nh_grp->neigh_tbl, &nh->gw_addr, nh->rif->dev);
++ if (!n) {
++ n = neigh_create(nh->nh_grp->neigh_tbl, &nh->gw_addr,
++ nh->rif->dev);
++ if (IS_ERR(n))
++ return PTR_ERR(n);
++ neigh_event_send(n, NULL);
++ }
++
++ mlxsw_sp_neigh_entry_remove(mlxsw_sp, neigh_entry);
++ neigh_entry->key.n = n;
++ err = mlxsw_sp_neigh_entry_insert(mlxsw_sp, neigh_entry);
++ if (err)
++ goto err_neigh_entry_insert;
++
++ read_lock_bh(&n->lock);
++ nud_state = n->nud_state;
++ dead = n->dead;
++ read_unlock_bh(&n->lock);
++ entry_connected = nud_state & NUD_VALID && !dead;
++
++ list_for_each_entry(nh, &neigh_entry->nexthop_list,
++ neigh_list_node) {
++ neigh_release(old_n);
++ neigh_clone(n);
++ __mlxsw_sp_nexthop_neigh_update(nh, !entry_connected);
++ mlxsw_sp_nexthop_group_refresh(mlxsw_sp, nh->nh_grp);
++ }
++
++ neigh_release(n);
++
++ return 0;
++
++err_neigh_entry_insert:
++ neigh_entry->key.n = old_n;
++ mlxsw_sp_neigh_entry_insert(mlxsw_sp, neigh_entry);
++ neigh_release(n);
++ return err;
++}
++
+ static void
+ mlxsw_sp_nexthop_neigh_update(struct mlxsw_sp *mlxsw_sp,
+ struct mlxsw_sp_neigh_entry *neigh_entry,
+- bool removing)
++ bool removing, bool dead)
+ {
+ struct mlxsw_sp_nexthop *nh;
+
++ if (list_empty(&neigh_entry->nexthop_list))
++ return;
++
++ if (dead) {
++ int err;
++
++ err = mlxsw_sp_nexthop_dead_neigh_replace(mlxsw_sp,
++ neigh_entry);
++ if (err)
++ dev_err(mlxsw_sp->bus_info->dev, "Failed to replace dead neigh\n");
++ return;
++ }
++
+ list_for_each_entry(nh, &neigh_entry->nexthop_list,
+ neigh_list_node) {
+ __mlxsw_sp_nexthop_neigh_update(nh, removing);
+--
+2.20.1
+
--- /dev/null
+From 25160a59f84267718cf82e99250267b14c0a86e0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 7 Nov 2019 11:30:39 +0100
+Subject: omap: pdata-quirks: remove openpandora quirks for mmc3 and wl1251
+
+From: H. Nikolaus Schaller <hns@goldelico.com>
+
+[ Upstream commit 2398c41d64321e62af54424fd399964f3d48cdc2 ]
+
+With a wl1251 child node of mmc3 in the device tree decoded
+in omap_hsmmc.c to handle special wl1251 initialization, we do
+no longer need to instantiate the mmc3 through pdata quirks.
+
+We also can remove the wlan regulator and reset/interrupt definitions
+and do them through device tree.
+
+Fixes: 81eef6ca9201 ("mmc: omap_hsmmc: Use dma_request_chan() for requesting DMA channel")
+Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
+Cc: <stable@vger.kernel.org> # v4.7+
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/mach-omap2/pdata-quirks.c | 93 ------------------------------
+ 1 file changed, 93 deletions(-)
+
+diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c
+index 6b433fce65a5b..2477f6086de4b 100644
+--- a/arch/arm/mach-omap2/pdata-quirks.c
++++ b/arch/arm/mach-omap2/pdata-quirks.c
+@@ -307,108 +307,15 @@ static void __init omap3_logicpd_torpedo_init(void)
+ }
+
+ /* omap3pandora legacy devices */
+-#define PANDORA_WIFI_IRQ_GPIO 21
+-#define PANDORA_WIFI_NRESET_GPIO 23
+
+ static struct platform_device pandora_backlight = {
+ .name = "pandora-backlight",
+ .id = -1,
+ };
+
+-static struct regulator_consumer_supply pandora_vmmc3_supply[] = {
+- REGULATOR_SUPPLY("vmmc", "omap_hsmmc.2"),
+-};
+-
+-static struct regulator_init_data pandora_vmmc3 = {
+- .constraints = {
+- .valid_ops_mask = REGULATOR_CHANGE_STATUS,
+- },
+- .num_consumer_supplies = ARRAY_SIZE(pandora_vmmc3_supply),
+- .consumer_supplies = pandora_vmmc3_supply,
+-};
+-
+-static struct fixed_voltage_config pandora_vwlan = {
+- .supply_name = "vwlan",
+- .microvolts = 1800000, /* 1.8V */
+- .gpio = PANDORA_WIFI_NRESET_GPIO,
+- .startup_delay = 50000, /* 50ms */
+- .enable_high = 1,
+- .init_data = &pandora_vmmc3,
+-};
+-
+-static struct platform_device pandora_vwlan_device = {
+- .name = "reg-fixed-voltage",
+- .id = 1,
+- .dev = {
+- .platform_data = &pandora_vwlan,
+- },
+-};
+-
+-static void pandora_wl1251_init_card(struct mmc_card *card)
+-{
+- /*
+- * We have TI wl1251 attached to MMC3. Pass this information to
+- * SDIO core because it can't be probed by normal methods.
+- */
+- if (card->type == MMC_TYPE_SDIO || card->type == MMC_TYPE_SD_COMBO) {
+- card->quirks |= MMC_QUIRK_NONSTD_SDIO;
+- card->cccr.wide_bus = 1;
+- card->cis.vendor = 0x104c;
+- card->cis.device = 0x9066;
+- card->cis.blksize = 512;
+- card->cis.max_dtr = 24000000;
+- card->ocr = 0x80;
+- }
+-}
+-
+-static struct omap2_hsmmc_info pandora_mmc3[] = {
+- {
+- .mmc = 3,
+- .caps = MMC_CAP_4_BIT_DATA | MMC_CAP_POWER_OFF_CARD,
+- .gpio_cd = -EINVAL,
+- .gpio_wp = -EINVAL,
+- .init_card = pandora_wl1251_init_card,
+- },
+- {} /* Terminator */
+-};
+-
+-static void __init pandora_wl1251_init(void)
+-{
+- struct wl1251_platform_data pandora_wl1251_pdata;
+- int ret;
+-
+- memset(&pandora_wl1251_pdata, 0, sizeof(pandora_wl1251_pdata));
+-
+- pandora_wl1251_pdata.power_gpio = -1;
+-
+- ret = gpio_request_one(PANDORA_WIFI_IRQ_GPIO, GPIOF_IN, "wl1251 irq");
+- if (ret < 0)
+- goto fail;
+-
+- pandora_wl1251_pdata.irq = gpio_to_irq(PANDORA_WIFI_IRQ_GPIO);
+- if (pandora_wl1251_pdata.irq < 0)
+- goto fail_irq;
+-
+- pandora_wl1251_pdata.use_eeprom = true;
+- ret = wl1251_set_platform_data(&pandora_wl1251_pdata);
+- if (ret < 0)
+- goto fail_irq;
+-
+- return;
+-
+-fail_irq:
+- gpio_free(PANDORA_WIFI_IRQ_GPIO);
+-fail:
+- pr_err("wl1251 board initialisation failed\n");
+-}
+-
+ static void __init omap3_pandora_legacy_init(void)
+ {
+ platform_device_register(&pandora_backlight);
+- platform_device_register(&pandora_vwlan_device);
+- omap_hsmmc_init(pandora_mmc3);
+- omap_hsmmc_late_init(pandora_mmc3);
+- pandora_wl1251_init();
+ }
+ #endif /* CONFIG_ARCH_OMAP3 */
+
+--
+2.20.1
+
--- /dev/null
+From e9733928a2360e8551f12e08a8d0bb0ad17d8f4a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 7 Oct 2019 16:55:10 +0900
+Subject: phy: renesas: rcar-gen3-usb2: Fix sysfs interface of "role"
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+[ Upstream commit 4bd5ead82d4b877ebe41daf95f28cda53205b039 ]
+
+Since the role_store() uses strncmp(), it's possible to refer
+out-of-memory if the sysfs data size is smaller than strlen("host").
+This patch fixes it by using sysfs_streq() instead of strncmp().
+
+Reported-by: Pavel Machek <pavel@denx.de>
+Fixes: 9bb86777fb71 ("phy: rcar-gen3-usb2: add sysfs for usb role swap")
+Cc: <stable@vger.kernel.org> # v4.10+
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Pavel Machek <pavel@denx.de>
+Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/phy/renesas/phy-rcar-gen3-usb2.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+index 7f5e36bfeee8d..f8c7ce89d8d73 100644
+--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
+@@ -22,6 +22,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/regulator/consumer.h>
++#include <linux/string.h>
+ #include <linux/workqueue.h>
+
+ /******* USB2.0 Host registers (original offset is +0x200) *******/
+@@ -234,9 +235,9 @@ static ssize_t role_store(struct device *dev, struct device_attribute *attr,
+ */
+ is_b_device = rcar_gen3_check_id(ch);
+ is_host = rcar_gen3_is_host(ch);
+- if (!strncmp(buf, "host", strlen("host")))
++ if (sysfs_streq(buf, "host"))
+ new_mode_is_host = true;
+- else if (!strncmp(buf, "peripheral", strlen("peripheral")))
++ else if (sysfs_streq(buf, "peripheral"))
+ new_mode_is_host = false;
+ else
+ return -EINVAL;
+--
+2.20.1
+
--- /dev/null
+From 803f1278cf83bda6a1782670a9704886ee219ad6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 7 Apr 2019 11:12:50 -0700
+Subject: power: supply: cpcap-battery: Fix signed counter sample register
+
+From: Tony Lindgren <tony@atomide.com>
+
+[ Upstream commit c68b901ac4fa969db8917b6a9f9b40524a690d20 ]
+
+The accumulator sample register is signed 32-bits wide register on
+droid 4. And only the earlier version of cpcap has a signed 24-bits
+wide register. We're currently passing it around as unsigned, so
+let's fix that and use sign_extend32() for the earlier revision.
+
+Signed-off-by: Tony Lindgren <tony@atomide.com>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/power/supply/cpcap-battery.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/power/supply/cpcap-battery.c b/drivers/power/supply/cpcap-battery.c
+index fe7fcf3a2ad03..7df9d432ee421 100644
+--- a/drivers/power/supply/cpcap-battery.c
++++ b/drivers/power/supply/cpcap-battery.c
+@@ -82,7 +82,7 @@ struct cpcap_battery_config {
+ };
+
+ struct cpcap_coulomb_counter_data {
+- s32 sample; /* 24-bits */
++ s32 sample; /* 24 or 32 bits */
+ s32 accumulator;
+ s16 offset; /* 10-bits */
+ };
+@@ -213,7 +213,7 @@ static int cpcap_battery_get_current(struct cpcap_battery_ddata *ddata)
+ * TI or ST coulomb counter in the PMIC.
+ */
+ static int cpcap_battery_cc_raw_div(struct cpcap_battery_ddata *ddata,
+- u32 sample, s32 accumulator,
++ s32 sample, s32 accumulator,
+ s16 offset, u32 divider)
+ {
+ s64 acc;
+@@ -224,7 +224,6 @@ static int cpcap_battery_cc_raw_div(struct cpcap_battery_ddata *ddata,
+ if (!divider)
+ return 0;
+
+- sample &= 0xffffff; /* 24-bits, unsigned */
+ offset &= 0x7ff; /* 10-bits, signed */
+
+ switch (ddata->vendor) {
+@@ -259,7 +258,7 @@ static int cpcap_battery_cc_raw_div(struct cpcap_battery_ddata *ddata,
+
+ /* 3600000μAms = 1μAh */
+ static int cpcap_battery_cc_to_uah(struct cpcap_battery_ddata *ddata,
+- u32 sample, s32 accumulator,
++ s32 sample, s32 accumulator,
+ s16 offset)
+ {
+ return cpcap_battery_cc_raw_div(ddata, sample,
+@@ -268,7 +267,7 @@ static int cpcap_battery_cc_to_uah(struct cpcap_battery_ddata *ddata,
+ }
+
+ static int cpcap_battery_cc_to_ua(struct cpcap_battery_ddata *ddata,
+- u32 sample, s32 accumulator,
++ s32 sample, s32 accumulator,
+ s16 offset)
+ {
+ return cpcap_battery_cc_raw_div(ddata, sample,
+@@ -312,6 +311,8 @@ cpcap_battery_read_accumulated(struct cpcap_battery_ddata *ddata,
+ /* Sample value CPCAP_REG_CCS1 & 2 */
+ ccd->sample = (buf[1] & 0x0fff) << 16;
+ ccd->sample |= buf[0];
++ if (ddata->vendor == CPCAP_VENDOR_TI)
++ ccd->sample = sign_extend32(24, ccd->sample);
+
+ /* Accumulator value CPCAP_REG_CCA1 & 2 */
+ ccd->accumulator = ((s16)buf[3]) << 16;
+--
+2.20.1
+
--- /dev/null
+From b737eb7e10dd53578793be200b75fe1f3940cdc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 16:09:33 -0800
+Subject: scsi: lpfc: Cap NPIV vports to 256
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 8b47ae69e049ae0b3373859d901f0334322f9fe9 ]
+
+Depending on the chipset, the number of NPIV vports may vary and be in
+excess of what most switches support (256). To avoid confusion with the
+users, limit the reported NPIV vports to 256.
+
+Additionally correct the 16G adapter which is reporting a bogus NPIV vport
+number if the link is down.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc.h | 3 ++-
+ drivers/scsi/lpfc/lpfc_attr.c | 12 ++++++++++--
+ drivers/scsi/lpfc/lpfc_init.c | 3 +++
+ 3 files changed, 15 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
+index 03e95a3216c8c..5fc41aa53ceb3 100644
+--- a/drivers/scsi/lpfc/lpfc.h
++++ b/drivers/scsi/lpfc/lpfc.h
+@@ -969,7 +969,8 @@ struct lpfc_hba {
+ struct list_head port_list;
+ struct lpfc_vport *pport; /* physical lpfc_vport pointer */
+ uint16_t max_vpi; /* Maximum virtual nports */
+-#define LPFC_MAX_VPI 0xFFFF /* Max number of VPI supported */
++#define LPFC_MAX_VPI 0xFF /* Max number VPI supported 0 - 0xff */
++#define LPFC_MAX_VPORTS 0x100 /* Max vports per port, with pport */
+ uint16_t max_vports; /*
+ * For IOV HBAs max_vpi can change
+ * after a reset. max_vports is max
+diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c
+index 82ce5d1930189..f447355cc9c04 100644
+--- a/drivers/scsi/lpfc/lpfc_attr.c
++++ b/drivers/scsi/lpfc/lpfc_attr.c
+@@ -1478,6 +1478,9 @@ lpfc_get_hba_info(struct lpfc_hba *phba,
+ max_vpi = (bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config) > 0) ?
+ (bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config) - 1) : 0;
+
++ /* Limit the max we support */
++ if (max_vpi > LPFC_MAX_VPI)
++ max_vpi = LPFC_MAX_VPI;
+ if (mvpi)
+ *mvpi = max_vpi;
+ if (avpi)
+@@ -1493,8 +1496,13 @@ lpfc_get_hba_info(struct lpfc_hba *phba,
+ *axri = pmb->un.varRdConfig.avail_xri;
+ if (mvpi)
+ *mvpi = pmb->un.varRdConfig.max_vpi;
+- if (avpi)
+- *avpi = pmb->un.varRdConfig.avail_vpi;
++ if (avpi) {
++ /* avail_vpi is only valid if link is up and ready */
++ if (phba->link_state == LPFC_HBA_READY)
++ *avpi = pmb->un.varRdConfig.avail_vpi;
++ else
++ *avpi = pmb->un.varRdConfig.max_vpi;
++ }
+ }
+
+ mempool_free(pmboxq, phba->mbox_mem_pool);
+diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
+index c69c2a2b2eadf..9fc5507ee39e7 100644
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -7643,6 +7643,9 @@ lpfc_sli4_read_config(struct lpfc_hba *phba)
+ bf_get(lpfc_mbx_rd_conf_xri_base, rd_config);
+ phba->sli4_hba.max_cfg_param.max_vpi =
+ bf_get(lpfc_mbx_rd_conf_vpi_count, rd_config);
++ /* Limit the max we support */
++ if (phba->sli4_hba.max_cfg_param.max_vpi > LPFC_MAX_VPORTS)
++ phba->sli4_hba.max_cfg_param.max_vpi = LPFC_MAX_VPORTS;
+ phba->sli4_hba.max_cfg_param.vpi_base =
+ bf_get(lpfc_mbx_rd_conf_vpi_base, rd_config);
+ phba->sli4_hba.max_cfg_param.max_rpi =
+--
+2.20.1
+
--- /dev/null
+From f500850f8027d62e0f5368c9ba8e1c94ab3a273a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Nov 2018 16:09:37 -0800
+Subject: scsi: lpfc: Correct code setting non existent bits in sli4 ABORT WQE
+
+From: James Smart <jsmart2021@gmail.com>
+
+[ Upstream commit 1c36833d82ff24d0d54215fd956e7cc30fffce54 ]
+
+Driver is setting bits in word 10 of the SLI4 ABORT WQE (the wqid). The
+field was a carry over from a prior SLI revision. The field does not exist
+in SLI4, and the action may result in an overlap with future definition of
+the WQE.
+
+Remove the setting of WQID in the ABORT WQE.
+
+Also cleaned up WQE field settings - initialize to zero, don't bother to
+set fields to zero.
+
+Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
+Signed-off-by: James Smart <jsmart2021@gmail.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/lpfc/lpfc_nvme.c | 2 --
+ drivers/scsi/lpfc/lpfc_sli.c | 14 +++-----------
+ 2 files changed, 3 insertions(+), 13 deletions(-)
+
+diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c
+index 6c4499db969c1..fcf4b4175d771 100644
+--- a/drivers/scsi/lpfc/lpfc_nvme.c
++++ b/drivers/scsi/lpfc/lpfc_nvme.c
+@@ -1544,7 +1544,6 @@ lpfc_nvme_fcp_abort(struct nvme_fc_local_port *pnvme_lport,
+ bf_set(abort_cmd_criteria, &abts_wqe->abort_cmd, T_XRI_TAG);
+
+ /* word 7 */
+- bf_set(wqe_ct, &abts_wqe->abort_cmd.wqe_com, 0);
+ bf_set(wqe_cmnd, &abts_wqe->abort_cmd.wqe_com, CMD_ABORT_XRI_CX);
+ bf_set(wqe_class, &abts_wqe->abort_cmd.wqe_com,
+ nvmereq_wqe->iocb.ulpClass);
+@@ -1559,7 +1558,6 @@ lpfc_nvme_fcp_abort(struct nvme_fc_local_port *pnvme_lport,
+ abts_buf->iotag);
+
+ /* word 10 */
+- bf_set(wqe_wqid, &abts_wqe->abort_cmd.wqe_com, nvmereq_wqe->hba_wqidx);
+ bf_set(wqe_qosd, &abts_wqe->abort_cmd.wqe_com, 1);
+ bf_set(wqe_lenloc, &abts_wqe->abort_cmd.wqe_com, LPFC_WQE_LENLOC_NONE);
+
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 62bea4ffdc25a..d3bad0dbfaf7f 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -10722,19 +10722,12 @@ lpfc_sli4_abort_nvme_io(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
+
+ /* Complete prepping the abort wqe and issue to the FW. */
+ abts_wqe = &abtsiocbp->wqe;
+- bf_set(abort_cmd_ia, &abts_wqe->abort_cmd, 0);
+- bf_set(abort_cmd_criteria, &abts_wqe->abort_cmd, T_XRI_TAG);
+-
+- /* Explicitly set reserved fields to zero.*/
+- abts_wqe->abort_cmd.rsrvd4 = 0;
+- abts_wqe->abort_cmd.rsrvd5 = 0;
+
+- /* WQE Common - word 6. Context is XRI tag. Set 0. */
+- bf_set(wqe_xri_tag, &abts_wqe->abort_cmd.wqe_com, 0);
+- bf_set(wqe_ctxt_tag, &abts_wqe->abort_cmd.wqe_com, 0);
++ /* Clear any stale WQE contents */
++ memset(abts_wqe, 0, sizeof(union lpfc_wqe));
++ bf_set(abort_cmd_criteria, &abts_wqe->abort_cmd, T_XRI_TAG);
+
+ /* word 7 */
+- bf_set(wqe_ct, &abts_wqe->abort_cmd.wqe_com, 0);
+ bf_set(wqe_cmnd, &abts_wqe->abort_cmd.wqe_com, CMD_ABORT_XRI_CX);
+ bf_set(wqe_class, &abts_wqe->abort_cmd.wqe_com,
+ cmdiocb->iocb.ulpClass);
+@@ -10749,7 +10742,6 @@ lpfc_sli4_abort_nvme_io(struct lpfc_hba *phba, struct lpfc_sli_ring *pring,
+ abtsiocbp->iotag);
+
+ /* word 10 */
+- bf_set(wqe_wqid, &abts_wqe->abort_cmd.wqe_com, cmdiocb->hba_wqidx);
+ bf_set(wqe_qosd, &abts_wqe->abort_cmd.wqe_com, 1);
+ bf_set(wqe_lenloc, &abts_wqe->abort_cmd.wqe_com, LPFC_WQE_LENLOC_NONE);
+
+--
+2.20.1
+
--- /dev/null
+From 2cb8c13ad090524a8dba08ba2a4dcaa2ac9fd01f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2019 20:01:52 -0700
+Subject: scsi: qla2xxx: Always check the qla2x00_wait_for_hba_online() return
+ value
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit e6803efae5acd109fad9f2f07dab674563441a53 ]
+
+This patch fixes several Coverity complaints about not always checking
+the qla2x00_wait_for_hba_online() return value.
+
+Cc: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Tested-by: Himanshu Madhani <hmadhani@marvell.com>
+Reviewed-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_attr.c | 3 ++-
+ drivers/scsi/qla2xxx/qla_target.c | 7 +++++--
+ 2 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
+index 1844c2f594605..656253285db9d 100644
+--- a/drivers/scsi/qla2xxx/qla_attr.c
++++ b/drivers/scsi/qla2xxx/qla_attr.c
+@@ -652,7 +652,8 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj,
+ break;
+ } else {
+ /* Make sure FC side is not in reset */
+- qla2x00_wait_for_hba_online(vha);
++ WARN_ON_ONCE(qla2x00_wait_for_hba_online(vha) !=
++ QLA_SUCCESS);
+
+ /* Issue MPI reset */
+ scsi_block_requests(vha->host);
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 2f5658554275c..69ed544d80ef0 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -6394,7 +6394,8 @@ qlt_enable_vha(struct scsi_qla_host *vha)
+ } else {
+ set_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags);
+ qla2xxx_wake_dpc(base_vha);
+- qla2x00_wait_for_hba_online(base_vha);
++ WARN_ON_ONCE(qla2x00_wait_for_hba_online(base_vha) !=
++ QLA_SUCCESS);
+ }
+ }
+ EXPORT_SYMBOL(qlt_enable_vha);
+@@ -6424,7 +6425,9 @@ static void qlt_disable_vha(struct scsi_qla_host *vha)
+
+ set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags);
+ qla2xxx_wake_dpc(vha);
+- qla2x00_wait_for_hba_online(vha);
++ if (qla2x00_wait_for_hba_online(vha) != QLA_SUCCESS)
++ ql_dbg(ql_dbg_tgt, vha, 0xe081,
++ "qla2x00_wait_for_hba_online() failed\n");
+ }
+
+ /*
+--
+2.20.1
+
--- /dev/null
+From f9b5f0e094097d4c32c6b6253a2cb90c6ec5e761 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Jul 2019 09:07:26 -0700
+Subject: scsi: qla2xxx: Fix DMA unmap leak
+
+From: Himanshu Madhani <hmadhani@marvell.com>
+
+[ Upstream commit 5d328de64d89400dcf9911125844d8adc0db697f ]
+
+With debug kernel we see following wanings indicating memory leak.
+
+[28809.523959] WARNING: CPU: 3 PID: 6790 at lib/dma-debug.c:978
+dma_debug_device_change+0x166/0x1d0
+[28809.523964] pci 0000:0c:00.6: DMA-API: device driver has pending DMA
+allocations while released from device [count=5]
+[28809.523964] One of leaked entries details: [device
+address=0x00000002aefe4000] [size=8208 bytes] [mapped with DMA_BIDIRECTIONAL]
+[mapped as coherent]
+
+Fix this by unmapping DMA memory.
+
+Signed-off-by: Quinn Tran <qutran@marvell.com>
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_bsg.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
+index 7472d3882ad41..6f8c7df69f66c 100644
+--- a/drivers/scsi/qla2xxx/qla_bsg.c
++++ b/drivers/scsi/qla2xxx/qla_bsg.c
+@@ -342,6 +342,8 @@ qla2x00_process_els(struct bsg_job *bsg_job)
+ dma_map_sg(&ha->pdev->dev, bsg_job->request_payload.sg_list,
+ bsg_job->request_payload.sg_cnt, DMA_TO_DEVICE);
+ if (!req_sg_cnt) {
++ dma_unmap_sg(&ha->pdev->dev, bsg_job->request_payload.sg_list,
++ bsg_job->request_payload.sg_cnt, DMA_TO_DEVICE);
+ rval = -ENOMEM;
+ goto done_free_fcport;
+ }
+@@ -349,6 +351,8 @@ qla2x00_process_els(struct bsg_job *bsg_job)
+ rsp_sg_cnt = dma_map_sg(&ha->pdev->dev, bsg_job->reply_payload.sg_list,
+ bsg_job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
+ if (!rsp_sg_cnt) {
++ dma_unmap_sg(&ha->pdev->dev, bsg_job->reply_payload.sg_list,
++ bsg_job->reply_payload.sg_cnt, DMA_FROM_DEVICE);
+ rval = -ENOMEM;
+ goto done_free_fcport;
+ }
+--
+2.20.1
+
--- /dev/null
+From 16561db45eec03368cbfcf96ab11faf59fca58a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 30 Aug 2019 15:23:57 -0700
+Subject: scsi: qla2xxx: Fix message indicating vectors used by driver
+
+From: Himanshu Madhani <hmadhani@marvell.com>
+
+[ Upstream commit da48b82425b8bf999fb9f7c220e967c4d661b5f8 ]
+
+This patch updates log message which indicates number of vectors used by
+the driver instead of displaying failure to get maximum requested
+vectors. Driver will always request maximum vectors during
+initialization. In the event driver is not able to get maximum requested
+vectors, it will adjust the allocated vectors. This is normal and does not
+imply failure in driver.
+
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Link: https://lore.kernel.org/r/20190830222402.23688-2-hmadhani@marvell.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_isr.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
+index 6a76d72175154..ebca1a470e9bc 100644
+--- a/drivers/scsi/qla2xxx/qla_isr.c
++++ b/drivers/scsi/qla2xxx/qla_isr.c
+@@ -3369,10 +3369,8 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
+ ha->msix_count, ret);
+ goto msix_out;
+ } else if (ret < ha->msix_count) {
+- ql_log(ql_log_warn, vha, 0x00c6,
+- "MSI-X: Failed to enable support "
+- "with %d vectors, using %d vectors.\n",
+- ha->msix_count, ret);
++ ql_log(ql_log_info, vha, 0x00c6,
++ "MSI-X: Using %d vectors\n", ret);
+ ha->msix_count = ret;
+ /* Recalculate queue values */
+ if (ha->mqiobase && ql2xmqsupport) {
+--
+2.20.1
+
--- /dev/null
+From 3672b35899e72e87981b9658152a8d3729cf61de Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 16:20:02 +0200
+Subject: scsi: qla2xxx: Fix message indicating vectors used by driver
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+[ Upstream commit 16561db45eec03368cbfcf96ab11faf59fca58a9 ]
+
+[ Upstream commit da48b82425b8bf999fb9f7c220e967c4d661b5f8 ]
+
+This patch updates log message which indicates number of vectors used by
+the driver instead of displaying failure to get maximum requested
+vectors. Driver will always request maximum vectors during
+initialization. In the event driver is not able to get maximum requested
+vectors, it will adjust the allocated vectors. This is normal and does not
+imply failure in driver.
+
+Signed-off-by: Himanshu Madhani <hmadhani@marvell.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Reviewed-by: Lee Duncan <lduncan@suse.com>
+Link: https://lore.kernel.org/r/20190830222402.23688-2-hmadhani@marvell.com
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-mem.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index b7b55eb82714f..96d7fc8b98fdc 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1866,10 +1866,14 @@ no_bw:
+ kfree(xhci->port_array);
+ kfree(xhci->rh_bw);
+ kfree(xhci->ext_caps);
++ kfree(xhci->usb2_rhub.psi);
++ kfree(xhci->usb3_rhub.psi);
+
+ xhci->usb2_ports = NULL;
+ xhci->usb3_ports = NULL;
+ xhci->port_array = NULL;
++ xhci->usb2_rhub.psi = NULL;
++ xhci->usb3_rhub.psi = NULL;
+ xhci->rh_bw = NULL;
+ xhci->ext_caps = NULL;
+
+--
+2.20.1
+
--- /dev/null
+From b80f92832952bc6c82b1becedead8743710bd571 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2019 20:01:48 -0700
+Subject: scsi: qla2xxx: Fix qla24xx_process_bidir_cmd()
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit c29282c65d1cf54daeea63be46243d7f69d72f4d ]
+
+Set the r??_data_len variables before using these instead of after.
+
+This patch fixes the following Coverity complaint:
+
+const: At condition req_data_len != rsp_data_len, the value of req_data_len
+must be equal to 0.
+const: At condition req_data_len != rsp_data_len, the value of rsp_data_len
+must be equal to 0.
+dead_error_condition: The condition req_data_len != rsp_data_len cannot be
+true.
+
+Cc: Himanshu Madhani <hmadhani@marvell.com>
+Fixes: a9b6f722f62d ("[SCSI] qla2xxx: Implementation of bidirectional.") # v3.7.
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Tested-by: Himanshu Madhani <hmadhani@marvell.com>
+Reviewed-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_bsg.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c
+index 6f8c7df69f66c..c1ca21a88a096 100644
+--- a/drivers/scsi/qla2xxx/qla_bsg.c
++++ b/drivers/scsi/qla2xxx/qla_bsg.c
+@@ -1782,8 +1782,8 @@ qla24xx_process_bidir_cmd(struct bsg_job *bsg_job)
+ uint16_t nextlid = 0;
+ uint32_t tot_dsds;
+ srb_t *sp = NULL;
+- uint32_t req_data_len = 0;
+- uint32_t rsp_data_len = 0;
++ uint32_t req_data_len;
++ uint32_t rsp_data_len;
+
+ /* Check the type of the adapter */
+ if (!IS_BIDI_CAPABLE(ha)) {
+@@ -1888,6 +1888,9 @@ qla24xx_process_bidir_cmd(struct bsg_job *bsg_job)
+ goto done_unmap_sg;
+ }
+
++ req_data_len = bsg_job->request_payload.payload_len;
++ rsp_data_len = bsg_job->reply_payload.payload_len;
++
+ if (req_data_len != rsp_data_len) {
+ rval = EXT_STATUS_BUSY;
+ ql_log(ql_log_warn, vha, 0x70aa,
+@@ -1895,10 +1898,6 @@ qla24xx_process_bidir_cmd(struct bsg_job *bsg_job)
+ goto done_unmap_sg;
+ }
+
+- req_data_len = bsg_job->request_payload.payload_len;
+- rsp_data_len = bsg_job->reply_payload.payload_len;
+-
+-
+ /* Alloc SRB structure */
+ sp = qla2x00_get_sp(vha, &(vha->bidir_fcport), GFP_KERNEL);
+ if (!sp) {
+--
+2.20.1
+
--- /dev/null
+From 6d835ddb8632ac3bed2851ff0a7f2dcd1b54b654 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 8 Aug 2019 20:01:40 -0700
+Subject: scsi: qla2xxx: Fix session lookup in qlt_abort_work()
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit ac452b8e79320c9e90c78edf32ba2d42431e4daf ]
+
+Pass the correct session ID to find_sess_by_s_id() instead of passing an
+uninitialized variable.
+
+Cc: Himanshu Madhani <hmadhani@marvell.com>
+Fixes: 2d70c103fd2a ("[SCSI] qla2xxx: Add LLD target-mode infrastructure for >= 24xx series") # v3.5.
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Tested-by: Himanshu Madhani <hmadhani@marvell.com>
+Reviewed-by: Himanshu Madhani <hmadhani@marvell.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/scsi/qla2xxx/qla_target.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index 11753ed3433ca..2f5658554275c 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -5918,7 +5918,6 @@ static void qlt_abort_work(struct qla_tgt *tgt,
+ struct qla_hw_data *ha = vha->hw;
+ struct fc_port *sess = NULL;
+ unsigned long flags = 0, flags2 = 0;
+- uint32_t be_s_id;
+ uint8_t s_id[3];
+ int rc;
+
+@@ -5931,8 +5930,7 @@ static void qlt_abort_work(struct qla_tgt *tgt,
+ s_id[1] = prm->abts.fcp_hdr_le.s_id[1];
+ s_id[2] = prm->abts.fcp_hdr_le.s_id[0];
+
+- sess = ha->tgt.tgt_ops->find_sess_by_s_id(vha,
+- (unsigned char *)&be_s_id);
++ sess = ha->tgt.tgt_ops->find_sess_by_s_id(vha, s_id);
+ if (!sess) {
+ spin_unlock_irqrestore(&ha->tgt.sess_lock, flags2);
+
+--
+2.20.1
+
--- /dev/null
+From 2d79138881e07b4146671724ae85389f97374659 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Oct 2019 18:12:53 +0200
+Subject: scsi: zfcp: trace channel log even for FCP command responses
+
+From: Steffen Maier <maier@linux.ibm.com>
+
+[ Upstream commit 100843f176109af94600e500da0428e21030ca7f ]
+
+While v2.6.26 commit b75db73159cc ("[SCSI] zfcp: Add qtcb dump to hba debug
+trace") is right that we don't want to flood the (payload) trace ring
+buffer, we don't trace successful FCP command responses by default. So we
+can include the channel log for problem determination with failed responses
+of any FSF request type.
+
+Fixes: b75db73159cc ("[SCSI] zfcp: Add qtcb dump to hba debug trace")
+Fixes: a54ca0f62f95 ("[SCSI] zfcp: Redesign of the debug tracing for HBA records.")
+Cc: <stable@vger.kernel.org> #2.6.38+
+Link: https://lore.kernel.org/r/e37597b5c4ae123aaa85fd86c23a9f71e994e4a9.1572018132.git.bblock@linux.ibm.com
+Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
+Signed-off-by: Steffen Maier <maier@linux.ibm.com>
+Signed-off-by: Benjamin Block <bblock@linux.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/s390/scsi/zfcp_dbf.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
+index 599447032e50a..bc6c1d6a1c42e 100644
+--- a/drivers/s390/scsi/zfcp_dbf.c
++++ b/drivers/s390/scsi/zfcp_dbf.c
+@@ -94,11 +94,9 @@ void zfcp_dbf_hba_fsf_res(char *tag, int level, struct zfcp_fsf_req *req)
+ memcpy(rec->u.res.fsf_status_qual, &q_head->fsf_status_qual,
+ FSF_STATUS_QUALIFIER_SIZE);
+
+- if (req->fsf_command != FSF_QTCB_FCP_CMND) {
+- rec->pl_len = q_head->log_length;
+- zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start,
+- rec->pl_len, "fsf_res", req->req_id);
+- }
++ rec->pl_len = q_head->log_length;
++ zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start,
++ rec->pl_len, "fsf_res", req->req_id);
+
+ debug_event(dbf->hba, level, rec, sizeof(*rec));
+ spin_unlock_irqrestore(&dbf->hba_lock, flags);
+--
+2.20.1
+
quota-fix-livelock-in-dquot_writeback_dquots.patch
ext4-fix-credit-estimate-for-final-inode-freeing.patch
reiserfs-fix-extended-attributes-on-the-root-directory.patch
+scsi-zfcp-trace-channel-log-even-for-fcp-command-res.patch
+scsi-qla2xxx-fix-dma-unmap-leak.patch
+scsi-qla2xxx-fix-session-lookup-in-qlt_abort_work.patch
+scsi-qla2xxx-fix-qla24xx_process_bidir_cmd.patch
+scsi-qla2xxx-always-check-the-qla2x00_wait_for_hba_o.patch
+scsi-qla2xxx-fix-message-indicating-vectors-used-by-.patch
+scsi-qla2xxx-fix-message-indicating-vectors-used-by-.patch-16108
+xhci-make-sure-interrupts-are-restored-to-correct-st.patch
+iio-adis16480-add-debugfs_reg_access-entry.patch
+phy-renesas-rcar-gen3-usb2-fix-sysfs-interface-of-ro.patch
+omap-pdata-quirks-remove-openpandora-quirks-for-mmc3.patch
+scsi-lpfc-cap-npiv-vports-to-256.patch
+scsi-lpfc-correct-code-setting-non-existent-bits-in-.patch
+drbd-change-drbd_request_detach_interruptible-s-retu.patch
+e100-fix-passing-zero-to-ptr_err-warning-in-e100_loa.patch
+x86-mce-amd-turn-off-mc4_misc-thresholding-on-all-fa.patch
+x86-mce-amd-carve-out-the-mc4_misc-thresholding-quir.patch
+power-supply-cpcap-battery-fix-signed-counter-sample.patch
+mlxsw-spectrum_router-refresh-nexthop-neighbour-when.patch
+media-vimc-fix-component-match-compare.patch
+ath10k-fix-fw-crash-by-moving-chip-reset-after-napi-.patch
--- /dev/null
+From 34d29bedb3c10ce313709c617ce8393073d15fd8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 16 Jan 2019 15:10:40 +0000
+Subject: x86/MCE/AMD: Carve out the MC4_MISC thresholding quirk
+
+From: Shirish S <Shirish.S@amd.com>
+
+[ Upstream commit 30aa3d26edb0f3d7992757287eec0ca588a5c259 ]
+
+The MC4_MISC thresholding quirk needs to be applied during S5 -> S0 and
+S3 -> S0 state transitions, which follow different code paths. Carve it
+out into a separate function and call it mce_amd_feature_init() where
+the two code paths of the state transitions converge.
+
+ [ bp: massage commit message and the carved out function. ]
+
+Signed-off-by: Shirish S <shirish.s@amd.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Kees Cook <keescook@chromium.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: Vishal Verma <vishal.l.verma@intel.com>
+Cc: Yazen Ghannam <yazen.ghannam@amd.com>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/1547651417-23583-3-git-send-email-shirish.s@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/mcheck/mce.c | 29 ----------------------
+ arch/x86/kernel/cpu/mcheck/mce_amd.c | 36 ++++++++++++++++++++++++++++
+ 2 files changed, 36 insertions(+), 29 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index dcc11303885b7..c7bd2e549a6a1 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -1660,35 +1660,6 @@ static int __mcheck_cpu_apply_quirks(struct cpuinfo_x86 *c)
+ if (c->x86 == 0x15 && c->x86_model <= 0xf)
+ mce_flags.overflow_recov = 1;
+
+- /*
+- * Turn off MC4_MISC thresholding banks on all models since
+- * they're not supported there.
+- */
+- if (c->x86 == 0x15) {
+- int i;
+- u64 hwcr;
+- bool need_toggle;
+- u32 msrs[] = {
+- 0x00000413, /* MC4_MISC0 */
+- 0xc0000408, /* MC4_MISC1 */
+- };
+-
+- rdmsrl(MSR_K7_HWCR, hwcr);
+-
+- /* McStatusWrEn has to be set */
+- need_toggle = !(hwcr & BIT(18));
+-
+- if (need_toggle)
+- wrmsrl(MSR_K7_HWCR, hwcr | BIT(18));
+-
+- /* Clear CntP bit safely */
+- for (i = 0; i < ARRAY_SIZE(msrs); i++)
+- msr_clear_bit(msrs[i], 62);
+-
+- /* restore old settings */
+- if (need_toggle)
+- wrmsrl(MSR_K7_HWCR, hwcr);
+- }
+ }
+
+ if (c->x86_vendor == X86_VENDOR_INTEL) {
+diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+index 4fa97a44e73fa..b434780ae6802 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c
++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c
+@@ -544,6 +544,40 @@ out:
+ return offset;
+ }
+
++/*
++ * Turn off MC4_MISC thresholding banks on all family 0x15 models since
++ * they're not supported there.
++ */
++void disable_err_thresholding(struct cpuinfo_x86 *c)
++{
++ int i;
++ u64 hwcr;
++ bool need_toggle;
++ u32 msrs[] = {
++ 0x00000413, /* MC4_MISC0 */
++ 0xc0000408, /* MC4_MISC1 */
++ };
++
++ if (c->x86 != 0x15)
++ return;
++
++ rdmsrl(MSR_K7_HWCR, hwcr);
++
++ /* McStatusWrEn has to be set */
++ need_toggle = !(hwcr & BIT(18));
++
++ if (need_toggle)
++ wrmsrl(MSR_K7_HWCR, hwcr | BIT(18));
++
++ /* Clear CntP bit safely */
++ for (i = 0; i < ARRAY_SIZE(msrs); i++)
++ msr_clear_bit(msrs[i], 62);
++
++ /* restore old settings */
++ if (need_toggle)
++ wrmsrl(MSR_K7_HWCR, hwcr);
++}
++
+ /* cpu init entry point, called from mce.c with preempt off */
+ void mce_amd_feature_init(struct cpuinfo_x86 *c)
+ {
+@@ -551,6 +585,8 @@ void mce_amd_feature_init(struct cpuinfo_x86 *c)
+ unsigned int bank, block, cpu = smp_processor_id();
+ int offset = -1;
+
++ disable_err_thresholding(c);
++
+ for (bank = 0; bank < mca_cfg.banks; ++bank) {
+ if (mce_flags.smca)
+ smca_configure(bank, cpu);
+--
+2.20.1
+
--- /dev/null
+From a576a7f3d1b9255e609b06253b0897986239eea7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 10 Jan 2019 07:54:40 +0000
+Subject: x86/MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models
+
+From: Shirish S <Shirish.S@amd.com>
+
+[ Upstream commit c95b323dcd3598dd7ef5005d6723c1ba3b801093 ]
+
+MC4_MISC thresholding is not supported on all family 0x15 processors,
+hence skip the x86_model check when applying the quirk.
+
+ [ bp: massage commit message. ]
+
+Signed-off-by: Shirish S <shirish.s@amd.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Tony Luck <tony.luck@intel.com>
+Cc: Vishal Verma <vishal.l.verma@intel.com>
+Cc: x86-ml <x86@kernel.org>
+Link: https://lkml.kernel.org/r/1547106849-3476-2-git-send-email-shirish.s@amd.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/x86/kernel/cpu/mcheck/mce.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index 4f3be91f0b0bc..dcc11303885b7 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -1661,11 +1661,10 @@ static int __mcheck_cpu_apply_quirks(struct cpuinfo_x86 *c)
+ mce_flags.overflow_recov = 1;
+
+ /*
+- * Turn off MC4_MISC thresholding banks on those models since
++ * Turn off MC4_MISC thresholding banks on all models since
+ * they're not supported there.
+ */
+- if (c->x86 == 0x15 &&
+- (c->x86_model >= 0x10 && c->x86_model <= 0x1f)) {
++ if (c->x86 == 0x15) {
+ int i;
+ u64 hwcr;
+ bool need_toggle;
+--
+2.20.1
+
--- /dev/null
+From 356623e23e81d8ce8058c26acba71dd022b4f460 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 11 Dec 2019 16:20:07 +0200
+Subject: xhci: make sure interrupts are restored to correct state
+
+From: Mathias Nyman <mathias.nyman@linux.intel.com>
+
+[ Upstream commit bd82873f23c9a6ad834348f8b83f3b6a5bca2c65 ]
+
+spin_unlock_irqrestore() might be called with stale flags after
+reading port status, possibly restoring interrupts to a incorrect
+state.
+
+If a usb2 port just finished resuming while the port status is read
+the spin lock will be temporary released and re-acquired in a separate
+function. The flags parameter is passed as value instead of a pointer,
+not updating flags properly before the final spin_unlock_irqrestore()
+is called.
+
+Cc: <stable@vger.kernel.org> # v3.12+
+Fixes: 8b3d45705e54 ("usb: Fix xHCI host issues on remote wakeup.")
+Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
+Link: https://lore.kernel.org/r/20191211142007.8847-7-mathias.nyman@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/xhci-hub.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 997ff183c9cbb..95503bb9b067d 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -855,7 +855,7 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ struct xhci_bus_state *bus_state,
+ __le32 __iomem **port_array,
+ u16 wIndex, u32 raw_port_status,
+- unsigned long flags)
++ unsigned long *flags)
+ __releases(&xhci->lock)
+ __acquires(&xhci->lock)
+ {
+@@ -937,12 +937,12 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ xhci_set_link_state(xhci, port_array, wIndex,
+ XDEV_U0);
+
+- spin_unlock_irqrestore(&xhci->lock, flags);
++ spin_unlock_irqrestore(&xhci->lock, *flags);
+ time_left = wait_for_completion_timeout(
+ &bus_state->rexit_done[wIndex],
+ msecs_to_jiffies(
+ XHCI_MAX_REXIT_TIMEOUT_MS));
+- spin_lock_irqsave(&xhci->lock, flags);
++ spin_lock_irqsave(&xhci->lock, *flags);
+
+ if (time_left) {
+ slot_id = xhci_find_slot_id_by_port(hcd,
+@@ -1090,7 +1090,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ break;
+ }
+ status = xhci_get_port_status(hcd, bus_state, port_array,
+- wIndex, temp, flags);
++ wIndex, temp, &flags);
+ if (status == 0xffffffff)
+ goto error;
+
+--
+2.20.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
